Vulnerabilities reported in Semaphore products
- Last Updated: May 13, 2026
- 1 minute read
- Semaphore
- Documentation
Every night the Semaphore products are scanned for vulnerabilities. Critical and High vulnerabilities are assessed each morning. Generally critical and high vulnerability issues are dealt with immediately with new Semaphore releases where required. However, some vulnerabilities are deemed false positives and so might show up in your scans. A list of these is below.
| CVE number | Description | Planned Action |
|---|---|---|
| CVE-2024-2700 | This is an issue where some development environment variables are persisted into the production code. However, we do not set quarkus prefixed environment variables in our build system so this does not apply to our product. | To remove the false positive, this library will be updated in due course. |
| CVE-2024-32007 | We do not use the vulnerable functionality in the Apache CFX library. | To remove the false positive, this library will be updated in due course. |